8
CVEs
1
Critical
4
High
0
KEV
0
PoC
5
Unpatched C/H
0.0%
Patch Rate
0.5%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
4
MEDIUM
3
LOW
0
Monthly CVE Trend
Affected Products (30)
Struxureware Data Center Expert
46
Java
32
Interactive Graphical Scada System
32
Enterprise Linux Workstation
31
Enterprise Linux Server
31
Enterprise Linux Desktop
30
Ubuntu Linux
28
Debian Linux
28
Enterprise Linux Server Tus
27
Modicon M580 Firmware
27
Enterprise Linux Server Aus
27
Enterprise Linux Server Eus
27
Jre
27
Jdk
27
Xp7 Command View
26
Modicon M340 Firmware
25
Modicon M340 Bmxp342020 Firmware
25
Satellite
24
U Motion Builder
23
Modicon M340 Bmxp341000 Firmware
21
Modicon M340 Bmxp3420302 Firmware
20
140Cpu65150 Firmware
20
Modicon M340 Bmxp342000 Firmware
19
Modicon M340 Bmxp3420102 Firmware
19
Ecostruxure Control Expert
19
Jrockit
19
Easergy T300 Firmware
19
Modicon M340 Bmxp3420102Cl Firmware
16
Xp Command View
16
Xp P9000 Command View
16
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-3869 | Authentication bypass in Schneider Electric Modicon M580 and Modicon M580 Safety PLCs stems from an incorrectly implemented authentication algorithm (CWE-303) that can be abused when an application project built at a lower application level is running on the controller. Remote attackers can compromise the confidentiality, integrity, and availability of the PLC, per the vendor's CVSS 4.0 base score of 9.2. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV. | CRITICAL | 9.2 | 0.5% | 46 |
No patch
|
| CVE-2026-77120 | Privilege escalation to root in Schneider Electric PowerLogic T300 (versions 2.9.8-5620 and prior) is achievable by an authenticated SSH user through OS command injection in the device's operating system console. An attacker with high-privilege SSH access can inject shell metacharacters into user-controlled console input that the device fails to properly sanitize, breaking out of the intended command context to execute arbitrary commands as root and perform unauthorized administrative operations. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 8.7 reflects subsequent-system impact rated High, consistent with the device's ICS/energy-metering deployment context. | HIGH | 8.7 | 0.4% | 44 |
No patch
|
| CVE-2026-19233 | Server-Side Request Forgery in Schneider Electric EcoStruxure IT Data Center Expert (formerly StruxureWare Data Center Expert) versions 9.1.2 and prior enables a privileged authenticated attacker to send crafted, unvalidated parameters to a server endpoint, causing the platform to make unauthorized outbound or internal requests. The resulting impact spans unauthorized command execution and disclosure of server-side data - a unusually severe outcome for SSRF, likely achieved by pivoting through the SSRF to reach privileged internal services. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV. | HIGH | 8.6 | 0.7% | 43 |
No patch
|
| CVE-2026-8044 | Remote code execution is possible in Schneider Electric EcoStruxure IT Data Center Expert (formerly StruxureWare Data Center Expert) versions 9.1.2 and prior via an argument injection flaw (CWE-88) in backup configuration parameter handling. An attacker holding a privileged account can supply crafted arguments that are passed unsanitized to an underlying backup command, resulting in arbitrary OS-level code execution on the server. No public exploit code or active exploitation has been identified at time of analysis, but the network-reachable attack vector and full CIA impact make this a meaningful risk for any organization operating this data center infrastructure management platform. | HIGH | 8.6 | 0.4% | 43 |
No patch
|
| CVE-2026-13336 | OS command injection in Schneider Electric NetBotz 5 (models 750 and 755) environmental monitoring appliances allows arbitrary Linux OS command execution when a system backup that has been maliciously modified is restored on the device. Exploitation requires high-privilege administrative access and adjacent network positioning, substantially narrowing the realistic threat population to insiders or supply-chain compromise scenarios. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV. | HIGH | 7.3 | 0.6% | 36 |
No patch
|
| CVE-2026-13348 | Unrestricted authentication attempts against Schneider Electric PowerChute™ Serial Shutdown expose user accounts to brute-force compromise when redirect handling is disabled in the application configuration. The absence of any rate-limiting or account-lockout mechanism (CWE-307) allows an attacker to submit unlimited credential-guessing requests over the network until valid credentials are found. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog. | MEDIUM | 6.9 | 0.3% | 34 |
No patch
|
| CVE-2026-81861 | Credential interception vulnerability in Schneider Electric SCADAPack RTUs (Remote Terminal Units) exposes authentication information over the network, enabling unauthorized access to RTU functionality. Affected products span the SCADAPack 3xx, 32, 47x/470R, and 57x families - all version ranges per CPE wildcards - used extensively in critical infrastructure sectors such as oil and gas pipelines, water systems, and electrical utilities. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but successful exploitation yields full credential disclosure and subsequent unauthorized control of industrial RTU assets. | MEDIUM | 5.9 | 0.4% | 30 |
No patch
|
| CVE-2026-13337 | HQL injection in Schneider Electric NetBotz 5 models 750 and 755 allows an authenticated attacker on the same adjacent network segment to inject malicious Hibernate Query Language statements through the appliance's web service interface or web UI, gaining limited unauthorized read and write access to the NetBotz database. The CVSS 4.0 score of 5.1 reflects a constrained attack surface - both network adjacency and a valid low-privilege account are prerequisites. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog. | MEDIUM | 5.1 | 0.2% | 26 |
No patch
|